Regulatory Fragmentation in Healthcare AI: A Policy Review of FDA Oversight, HIPAA, and Implementation Barriers

Abstract

Background: The rapid integration of artificial intelligence (AI) into U.S. healthcare has exposed gaps in existing governance frameworks. Although the FDA has cleared more than 150 AI-enabled devices since 2019, implementation in clinical practice remains slow, uneven, and burdened by regulatory fragmentation.
Methods: This study conducted a mixed-methods secondary analysis combining (1) FDA regulatory pathway review of AI/ML medical devices (2019–2023), (2) case study analysis of 72 publicly reported AI implementations in U.S. healthcare systems, and (3) structured review of HIPAA regulations and policy documents. Descriptive statistics summarized regulatory pathways, approval timelines, and post-market surveillance requirements. Thematic synthesis identified recurring compliance challenges and governance gaps.
Results: The FDA database analysis revealed that most AI tools (67%) were cleared via the 510(k) pathway, with an average review time of 6.1 months. However, only 34% of devices had explicit post-market surveillance obligations. Case study review showed that 82% of implementations encountered HIPAA-related barriers, particularly around data de-identification and consent for secondary use. Smaller hospitals reported longer implementation delays and higher relative compliance costs, with regulatory uncertainty cited as the primary barrier.
Conclusion: Current U.S. healthcare AI governance is fragmented across HIPAA and FDA frameworks, creating operational, legal, and economic burdens for health systems. Harmonized, risk-based oversight that integrates privacy and safety requirements could reduce inefficiencies and improve equitable AI adoption. These findings provide an evidence-based foundation for policy reforms that balance innovation with patient protection.